Moxilla Firefox allows remote attackers to bypass the Same Origin Policy to read arbitrary files or gain privileges.
The SVG filter implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to obtain sensitive displacement-correlation information, and possibly bypass the Same Origin Policy and read text from a different domain, via a timing attack involving feDisplacementMap elements, a related issue to CVE-2013-1693.
Bodo Möller, Thai Duong and Krzysztof Kotowicz of Google discovered a flaw in the design of SSL version 3.0 that would allow an attacker to calculate the plaintext of secure connections, allowing, for example, secure HTTP cookies to be stolen.
References: http://googleonlinesecurity.blogspot.com/2014/10/this-poodle-bites-exploiting-ssl-30.html https://www.openssl.org/~bodo/ssl-poodle.pdf
A flaw was found in in the Linux kernel's USB device management code which could cause a crash when a device which required sndusbaudio driver. The kernel would panic causing null pointer dereference attempting to access non existent endpoints.
Product bugs:
https://bugzilla.redhat.com/showbug.cgi?id=1283355 https://bugzilla.redhat.com/showbug.cgi?id=1283358
A local kernel crash on invalid USB device requiring the visor driver was reported. The clie5attach function of the visor driver, which is called during the driver initialization process, expects an OUT-Bulk-Endpoint. Due to an incomplete sanity check, the visor driver tries to dereference null-pointers, which results in crash.
Vulnerable code:
CentOS-Kernel linux-3.10.0-229.14.1.el7 (drivers/usb/serial/visor.c) ... 607 608 pipe = usbsndbulkpipe(serial->dev, port->bulkoutendpointAddress); 609 for (j = 0; j < ARRAYSIZE(port->writeurbs); ++j) 610 port->writeurbs[j]->pipe = pipe; / if there is no configured OUT-bulk-endpoint, the kernel tries to dereference null-pointers / 611 612 return 0; 613 } ...
Reproducer can be found in original bug report: https://bugzilla.redhat.com/showbug.cgi?id=1283371
Proposed upstream patch: http://marc.info/?l=linux-usb&m=145260786729359&w=2
Upstream commit: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=cb3232138e37129e88240a98a1d2aba2187ff57c
Bugtraq: http://seclists.org/bugtraq/2016/Mar/58
Kernel crash occurs when presented a buggy USB device which requires wacom driver, causing null pointer dereference.
Product bugs:
https://bugzilla.redhat.com/showbug.cgi?id=1283375 https://bugzilla.redhat.com/showbug.cgi?id=1283377